Power Attorney System

Account delegation for WordPress. A user (the delegator) can authorize a trusted user (the delegate) to act on their behalf. The delegate approves the request, can then switch into the delegator's account with one click, and every action taken on the delegated account is recorded in an activity log.

Developed by Pomnex.

Features

• Delegation requests. Any user can ask another user to act on their behalf. The delegate approves or rejects the request.
• Optional expiry. A delegation can end automatically on a chosen date, or stay in place until it is revoked.
• Revocation at any time. Either party can revoke an active delegation. An active session on the delegated account ends on the next request.
• Account switching. Delegates switch accounts from the admin bar, the Delegated to Me screen or the front-end dashboard, and return to their own account with one click. A notice is shown on every screen while acting on behalf of someone else.
• Activity log. Account switches, delegation changes, post and comment changes, profile updates and changes to key site settings are logged with date, time and IP address.
• Front-end dashboard. The [pas_delegation_dashboard] shortcode gives logged-in users the same features outside wp-admin.
• Translation-ready. English source strings, with a complete Arabic translation included. The layout follows the site direction (LTR or RTL).
• Multisite-aware. Works when activated per site or network-wide.

Requirements

• WordPress 6.0 or later
• PHP 7.4 or later
• MySQL 5.6+ or MariaDB 10.1+

Installation

1. Download the latest release ZIP from the Releases page, or clone the repository into wp-content/plugins/power-attorney-system:

   cd wp-content/plugins
   git clone https://github.com/Pomnex/power-attorney-system-wp-plugin.git power-attorney-system

2. Activate Power Attorney System from the Plugins screen.

3. Open the new Delegation menu in wp-admin.

The plugin folder must be named power-attorney-system. GitHub's automatic source archives use the repository name (power-attorney-system-wp-plugin-…), so rename the folder after extracting one. Otherwise WordPress treats it as a different plugin, and sites updating from an earlier version would find it deactivated.

Usage

Send a delegation request

1. Go to Delegation → My Delegations.
2. Search for the user you want to delegate to.
3. Optionally choose an expiry date. Leave it empty for a permanent delegation.
4. Click Send request. The delegate receives an email and an in-app notification.

Approve or reject a request

Go to Delegation → Requests and click Approve or Reject.

Switch accounts

After approving a request, the delegate sees a Switch Account menu in the admin bar and a card for each delegator under Delegation → Delegated to Me. Use Return to my account to switch back. Logging out also ends the switched session.

Review activity

Delegation → Activity Log lists everything delegates did on your account. From My Delegations or Delegated to Me you can open the log of a single delegation.

Front-end dashboard

Add this shortcode to any page:

[pas_delegation_dashboard]

[power_attorney] is kept as an alias. Visitors who are not logged in see a login link.

Security model

A delegate acts with all of the delegator's capabilities, so only delegate to people you fully trust. To keep every delegation revocable, the plugin enforces these rules while a delegate is switched into another account:

• The delegator's password and email address cannot be changed, through the profile screen, the REST API or any other code path. No login cookie is ever issued for the delegator.
• Application passwords cannot be created for the delegator.
• Delegations cannot be managed (no new requests, approvals, rejections or revocations) until the delegate returns to their own account. This prevents sub-delegations that would survive a revocation.
• Every request checks that the delegation is still approved and not expired.

Other protections:

• Every AJAX endpoint checks a nonce and the user's relationship to the delegation. Delegation details and activity logs are visible only to the delegator and the delegate.
• The user search does not expose login names or full email addresses to users who cannot list users. Those users can search by name or by an exact email address.
• Delegation requests are rate-limited (10 per user per hour by default).
• The activity log records the connection's REMOTE_ADDR. Forwarding headers are ignored by default because clients can forge them (see the pas_client_ip filter).

Hooks for developers

Actions

Hook	Arguments	Fires
pas_switched_user	$delegate_id, $delegator_id, $delegation	After a delegate switches into a delegator's account.
pas_returned_to_original	$delegate_id	After a delegate returns to their own account.
pas_log_activity	$action_type, $description, $delegation_id = null	Call it with do_action() to add your own entry to the activity log of the current delegated session.

Filters

Filter	Default	Purpose
pas_client_ip	REMOTE_ADDR	IP address stored in the activity log. Use it to read a trusted proxy header.
pas_request_rate_limit	10	Delegation requests allowed per user per hour. 0 disables the limit.
pas_can_view_user_emails	current_user_can( 'list_users' )	Whether search results show full email addresses and login names.
pas_user_search_ids	matching IDs	Adjust the user IDs returned by the delegate search.
pas_user_display_name	'' or the family-table name	Display name used in search results. Return '' to use the WordPress display name.
pas_protect_delegator_credentials	true	Whether the delegator's password, email and application passwords are protected while a delegate is switched in.
pas_committee_menu_roles	committee_chair, administrator	Roles that may see committee admin menus while switched.
pas_committee_menu_keywords	committee, lajna and the Arabic word for "committee"	Keywords that identify committee admin menus by title or slug.

Example: trust a reverse proxy's X-Forwarded-For header.

add_filter( 'pas_client_ip', function ( $ip ) {
    if ( '10.0.0.5' === $ip && isset( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) {
        $forwarded = explode( ',', sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) );
        return trim( $forwarded[0] );
    }
    return $ip;
} );

Optional family-name integration

If the database contains a {prefix}data_family table with user_id, firstname, father_name and grandfather_name columns, the user search also matches those names and shows them as "First bin Father bin Grandfather". Sites without this table are not affected.

Translations

Source strings are in English. The Arabic translation lives in languages/power-attorney-system-ar.po, compiled to .mo. WordPress loads it automatically when the site or user language is Arabic.

To regenerate the template after changing strings (requires WP-CLI):

wp i18n make-pot . languages/power-attorney-system.pot

Development

Code follows the WordPress Coding Standards. The ruleset is in phpcs.xml.dist:

composer global config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
composer global require wp-coding-standards/wpcs:"^3.0" phpcompatibility/phpcompatibility-wp:"*"
phpcs

Known limitations

The switched state is stored per user, not per browser session. If a delegate is logged in on several devices, switching on one device switches all of them.

Security

Please report vulnerabilities privately. See SECURITY.md.

Changelog

See CHANGELOG.md.

License

Copyright (C) 2026 Pomnex

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

Additional term under GPLv3 Section 7(b): you must preserve the original author attribution ("Developed by Pomnex") in the source code headers and in the plugin's settings/about screen.